CVE-2025-57749: N8n Workflow Automation Path Traversal

CVE-2025-57749 Overview

CVE-2025-57749 is a symlink traversal vulnerability in the Read/Write File node of n8n, an open-source workflow automation platform. Versions before 1.106.0 fail to properly validate symbolic links when enforcing directory restrictions. An authenticated user who can create symlinks, such as through the Execute Command node, can bypass path restrictions and read or write files outside the permitted directories. The flaw is tracked under CWE-59: Improper Link Resolution Before File Access. Users of the managed n8n.cloud service are not affected. Self-hosted deployments should upgrade to 1.106.0 or later.

Critical Impact
Authenticated workflow users can escape directory sandboxing to access sensitive files on the host, exposing credentials, configuration, and other protected data.

Affected Products

n8n self-hosted, versions prior to 1.106.0
n8n Node.js distributions using the Read/Write File node
Deployments that expose the Execute Command node to workflow authors

Discovery Timeline

2025-08-20 - CVE-2025-57749 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57749

Vulnerability Analysis

The Read/Write File node in n8n enforces a denylist of sensitive directories and files to prevent workflows from accessing host-level secrets. The check operates on the literal path string supplied to the node. It does not resolve symbolic links before comparing paths against the restricted set.

An attacker with workflow authoring privileges creates a symbolic link inside a permitted directory that points to a restricted target. When the Read/Write File node opens the link, the underlying filesystem call follows the symlink to the sensitive destination. The restriction check passes because the visible path appears legitimate.

Exploitation requires low-privileged authenticated access. It does not require user interaction and can be automated as part of a workflow.

Root Cause

The root cause is missing canonicalization of file paths before authorization checks, a classic CWE-59 time-of-check to time-of-use pattern. The node validates the requested path string rather than the resolved inode target. See GitHub Pull Request #17735 for the corrective logic.

Attack Vector

An authenticated user builds a workflow that first invokes the Execute Command node to run ln -s /etc/passwd /data/workflow/link.txt. The workflow then invokes the Read/Write File node against /data/workflow/link.txt. The node accepts the path as it resides in an allowed directory, but the read operation follows the symlink and returns the contents of /etc/passwd. The same pattern enables arbitrary file writes to protected locations. Refer to the GitHub Security Advisory GHSA-ggjm-f3g4-rwmm for vendor detail.

Detection Methods for CVE-2025-57749

Indicators of Compromise

Execute Command node executions containing ln -s, symlink, or mklink invocations
Read/Write File node activity referencing paths that resolve outside the intended data directory
Unexpected access to sensitive files such as /etc/passwd, /etc/shadow, .env files, or n8n credential stores
Newly created symbolic links inside directories used by n8n workflows

Detection Strategies

Audit n8n execution logs for workflows that combine the Execute Command node with the Read/Write File node in sequence.
Enable filesystem auditing (auditd on Linux) on directories writable by the n8n process to flag symlink creation events.
Compare the node version reported by /rest/settings or the container image tag against the fixed release 1.106.0.

Monitoring Recommendations

Ship n8n container and host logs to a centralized log platform and alert on symlink syscalls originating from the n8n process.
Monitor for reads of credential files, private keys, and cloud metadata endpoints by the n8n service account.
Track workflow creation and modification events to identify unauthorized additions of Execute Command or Read/Write File nodes.

How to Mitigate CVE-2025-57749

Immediate Actions Required

Upgrade all self-hosted n8n instances to version 1.106.0 or later.
Restrict access to the Execute Command node to trusted administrators only.
Review existing workflows for symlink creation commands and unexpected Read/Write File node targets.
Rotate any credentials, API keys, or secrets that were accessible to the n8n process during the exposure window.

Patch Information

The fix is delivered in n8n 1.106.0. The patch resolves file paths and rejects requests that traverse symbolic links out of permitted directories. Review the GitHub Pull Request #17735 and the GitHub Security Advisory GHSA-ggjm-f3g4-rwmm for full remediation notes. Managed n8n.cloud tenants require no action.

Workarounds

Disable the Execute Command node using the NODES_EXCLUDE environment variable if immediate patching is not possible.
Run n8n under a dedicated low-privilege user with filesystem access limited to a chrooted or bind-mounted workflow directory.
Apply mandatory access controls such as AppArmor or SELinux profiles that prevent the n8n process from following symlinks outside its data directory.

bash

# Exclude high-risk nodes and pin the patched version
export NODES_EXCLUDE="[\"n8n-nodes-base.executeCommand\"]"
docker pull n8nio/n8n:1.106.0
docker run -d --name n8n \
  -e NODES_EXCLUDE="$NODES_EXCLUDE" \
  -v n8n_data:/home/node/.n8n \
  n8nio/n8n:1.106.0